gobuster

Enumerate directories, DNS subdomains, and virtual hosts on web servers.

15|1|Updated Feb 12, 2026
One-click install
npx skills add https://github.com/AeonDave/malskill --skill gobuster
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: gobuster
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/recon/gobuster
Command: npx skills add https://github.com/AeonDave/malskill --skill gobuster

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps uncover hidden directories, files, subdomains, and virtual hosts on web servers, which are often overlooked during manual reconnaissance.

Core Features & Use Cases

  • Directory Brute-forcing: Finds hidden directories and files on a web server.
  • DNS Subdomain Enumeration: Discovers subdomains associated with a given domain.
  • Virtual Host Discovery: Identifies virtual hosts configured on a web server.
  • Use Case: When tasked with finding all accessible paths on a target website, use this Skill to enumerate common and uncommon directories and files.

Quick Start

Use the gobuster skill to perform a directory brute-force scan against http://example.com using a common wordlist.

Frequently Asked Questions about gobuster

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover hidden directories and files on a web server?

Directory brute-force enumeration identifies hidden files and directories on a web server by systematically requesting paths from a wordlist against the target URL to uncover potential attack vectors.

Can I find subdomains associated with a target domain?

Yes, you can find subdomains associated with a target domain by executing DNS subdomain enumeration, which brute-forces DNS records using wordlists to reveal underlying network infrastructure.

Does web enumeration require wordlists to function?

Yes, web enumeration requires wordlists for effective operation, as the brute-force technique systematically checks paths, DNS subdomains, and virtual hosts against provided input lists.

What is the best way to identify virtual hosts configured on a web server?

The best way to identify virtual hosts configured on a web server is through vhost discovery, a brute-force technique that probes the server with various Host headers to uncover configured virtual hosts.

How do I filter out unwanted results during directory brute-force scans?

You can filter out unwanted results during directory brute-force scans by applying supported filtering options to remove specific HTTP status codes, ensuring output only contains relevant discovered content.